Immutable provider configuration belonging to one logical session.

startup_timeout bounds Store reconciliation and provider opening; startup_finalization_timeout separately bounds initial persistence, rollback, cleanup, and readiness acknowledgement. turn_start_timeout bounds asynchronous provider admission. provider_command_timeout bounds response and cancellation callbacks and must be shorter than the application :provider_command_call_timeout used by the public response call.

env, provider_options, and mcp_servers can carry credentials (API keys, auth headers), so the Inspect implementation redacts them: each keeps its top-level keys with "[REDACTED]" values, which shows what was configured without exposing it. Values nested below the top level are redacted along with everything else. Code that renders a config through means that bypass the Inspect protocol (for example inspect(config, structs: false) or Erlang ~p formatting of the raw term) still exposes the original values.

Supervisor progress and child-start reports carry the full start arguments of a session process, config included, and none of the redaction here applies to them. Elixir's logger drops those SASL reports by default; leave handle_sasl_reports off in any environment whose logs are shipped or retained.